explorer.exe

[mrg81]

Hi,

Today a friend mine came up with a problem;

the problem: He starts the machine, reaches windows but no log on screen. He pressed ctrl+alt+del

brings up the window that has log off, shut down task manger etc...
checks the process running in task manager, multiple copies of explorer.exe and is being continuously refreshed.

Still cannot see the desktop,

ends the process explorer.exe and then goes to applications> new task and then types explorer.exe and could see the desktop. We ran antivirus (Macafee v7.00 to check forviruses but nothing

can any one help.

MRG.

[CXGJarrod]

Can he boot into safe mode? (f8 at startup) What version of Windows is he running?

[SwordFish_13]

hi

Just a guess.....Multiple Explorer might me Explorer.zip Trojan or something like that i don't remembeer the actual name...........Because it happened to me once

If it is. the virus or trojan i am referring to.... there must be a extra explorer.exe in "c:\" go to "command Prompt" browse to the "c:\ prompt" Type "Attrib explorer.exe" if it shows something like " A SHR Explorer.exe " then my guess could be true...because the Legit explorer.exe is stored in "%System Root%\windows" folder.......

then "attrib explorer.exe -a -s -h -r " then delete the file.

else it will show file not ..found.........

It's a trick some malware use to name themself same as some Legit process.......to hide themself...

I suggest you scan your PC with Housecall and a good trojan temover like TDS -3

--Good Luck--

[mrg81]

For srword fish,

I went to command prompt and on c:\
i typed attrib explorer.exe it said file not found , the OS inWin 2k, I don't know whether we can boot in safe mode or not for none of us have tried that.

MRG.

[SwordFish_13]

hi

Multipe explorer.exe are definate trouble.......one of them is not legit......Yes you can boot into safe mode in Wondows2000 .....you will have to Press F8 ....Just Before the Loding bar starts.....in that black screen....just after the CMOS Screen.......it will give you a menu .....Normal Boot...Command Prompt only ...Command Prompt wiht Networking Support....and boot into Safe mode etc etc....after getting into safe mode check wether there are two explorer.exe's there too.....

I think you are infected with a malware.... i would suggst you Scan your PC with Housecall and TDS-3....

If they don't find anything let us know ......

and if they do find anything still let us know ...

--Good Luck--]

[Karvec]

i had that happen to me, also, running winxp... Myself, I just did a reformat. Heh... But recovering without that would be much better. No need to reinstall everything. I think. And hope.

[NemorY]

I heard something about explorer.exe trojan ?

http://cexx.org/dlder.htm

(removal instructions included....)

[mrg81]

I used process explorer and found a process mfcsv.exe , i searched google but nothing...

So i updated my antivirus macafee and then it said that it is a virus, I have still no idea and will look into the souluns suggested.

Thanks
MRG.